Analysis

  • max time kernel
    91s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2024, 22:22

General

  • Target

    82b6aefc08b359173217678342f22080.exe

  • Size

    1.3MB

  • MD5

    82b6aefc08b359173217678342f22080

  • SHA1

    7318475d895614ffe34e690045674ac46331e26e

  • SHA256

    9be1467f145c688ecea5a3c8e25d870a53da1f17b3c7de248ef57123fa2b32ca

  • SHA512

    c6af2a1bd5c1cbd306a99dd3bd7090de00eeef806d7260cd569093a3d7649125a67b9d7b4ac2944fda0a2884f2e17865b88fd904bd221eb2bc7ea6f4ba08b6ab

  • SSDEEP

    12288:Vc9JbxZOZJz4Cs1MGtbgE6vtx+GC84jvYV7uKqSJrg3yFwEn0wvqybK4HtLGEUBI:m/OP/GFz6vj+hzs8

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82b6aefc08b359173217678342f22080.exe
    "C:\Users\Admin\AppData\Local\Temp\82b6aefc08b359173217678342f22080.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ikzxGmHjkZst" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB630.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1768
        3⤵
        • Program crash
        PID:3664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1520 -ip 1520
    1⤵
      PID:3816

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmpB630.tmp

            Filesize

            1KB

            MD5

            7a851e5aab6a4a0c52af07561e3834cd

            SHA1

            2f4e9b4f556f5e7be8c21d1f87e3d42a0dbe6ae8

            SHA256

            173d2b53c73db63c80b425af44ed66aac027586714189d6e6b95d49db752b842

            SHA512

            b406c157c35a096fcc3fbf4164fb0b347ab6ac946d058d45505d4a4c5ec9fc3981e00742c6ca1f7d40ce74a7ae3825be43f0cad82744b58c5b10c87a32e1a588

          • memory/1520-21-0x0000000074650000-0x0000000074E00000-memory.dmp

            Filesize

            7.7MB

          • memory/1520-20-0x0000000005400000-0x0000000005410000-memory.dmp

            Filesize

            64KB

          • memory/1520-19-0x0000000074650000-0x0000000074E00000-memory.dmp

            Filesize

            7.7MB

          • memory/1520-16-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/4464-8-0x0000000004BE0000-0x0000000004BF4000-memory.dmp

            Filesize

            80KB

          • memory/4464-12-0x0000000006680000-0x00000000066B8000-memory.dmp

            Filesize

            224KB

          • memory/4464-6-0x0000000005210000-0x000000000521A000-memory.dmp

            Filesize

            40KB

          • memory/4464-1-0x0000000074650000-0x0000000074E00000-memory.dmp

            Filesize

            7.7MB

          • memory/4464-9-0x0000000074650000-0x0000000074E00000-memory.dmp

            Filesize

            7.7MB

          • memory/4464-10-0x00000000052F0000-0x0000000005300000-memory.dmp

            Filesize

            64KB

          • memory/4464-11-0x0000000006600000-0x0000000006684000-memory.dmp

            Filesize

            528KB

          • memory/4464-7-0x00000000053A0000-0x00000000053F6000-memory.dmp

            Filesize

            344KB

          • memory/4464-5-0x00000000052F0000-0x0000000005300000-memory.dmp

            Filesize

            64KB

          • memory/4464-4-0x0000000005300000-0x0000000005392000-memory.dmp

            Filesize

            584KB

          • memory/4464-18-0x0000000074650000-0x0000000074E00000-memory.dmp

            Filesize

            7.7MB

          • memory/4464-3-0x0000000005810000-0x0000000005DB4000-memory.dmp

            Filesize

            5.6MB

          • memory/4464-2-0x0000000005160000-0x00000000051FC000-memory.dmp

            Filesize

            624KB

          • memory/4464-0-0x0000000000630000-0x0000000000786000-memory.dmp

            Filesize

            1.3MB